MedusaLocker

MedusaLocker is a potent malware variant, first observed in 2019 and primarily targeting the healthcare sector. It gained notoriety during the COVID-19 pandemic when it leveraged the disorder and confusion to launch attacks, as reported by the US Department of Health and Human Services in February 2023. This ransomware is distinct from Medusa, a Ransomware-as-a-Service (RaaS) platform that has been active since late 2022 and often uses the double extortion method for monetary gain. Both MedusaLocker and Medusa have been prevalent in Singapore's threat landscape, reflecting global trends. PCrisk discovered a new variant of MedusaLocker in 2024, which appends the .crypto1317 extension to encrypted files and drops a ransom note named "How_to_back_files.html". The malware operates by terminating specific services referenced in a hardcoded list, similar to other types of ransomware. After gaining initial access, MedusaLocker spreads through a network via a batch file executing a PowerShell script. It disables security and forensic software, restarts the machine in safe mode to evade detection, and then employs AES-256 encryption to lock files. Researchers have noticed that MedusaLocker has been used by various ransomware operations, including AvosLocker, BlackCat, Trigona, and LockBit. These operations have caused significant disruptions and damage across multiple sectors, reinforcing the need for robust cybersecurity measures. As these threats continue to evolve, it is crucial to remain vigilant and invest in proactive defenses against such malicious software.